Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Leverage Stripe-formatted IDs for internal UUID values in your Pydantic models and FastAPI views; automatically validates prefixes, and converts to/from UUID values.
fastapi-uuidbase62
is intended to provide Pydantic and FastAPI functionality that exposes UUID values as
nicely-formatted Stripe-like string values, with validated prefixing. For example, a User UUID identifier of
"f8711c37-c1d1-4961-ba3c-98cdc5b4fda8"
with a "user"
prefix becomes "user_7yNMTpVy8ddRxYKGJqtk7e"
.
Why take this approach?
fastapi-uuidbase62
installation is much the same as any other Python package.
pip install fastapi-uuidbase62
Python 3.7, 3.8, 3.9, 3.10, 3.11 are supported and covered by the tox
test configuration described below.
This package provides the ability to define a field on a Pydantic model that auto-serializes a UUID value to base62 and auto-prefixes a defined label. This serializes a UUID to a prefixed string when rendering a FastAPI response, and does the reverse when processing an incoming FastAPI request.
In the following example, take note of the following:
UUIDBase62ModelMixin
adds a to_uuidbase62
method to Model to easily convert a UUID or valid base62 prefixed value to a UUIDBase62
valuecon_uuidbase62
function, which defines the autoprefixing and serializing UUID <-> str fieldget_validated_uuidbase62_by_model
dependency injection function providing validation/serialization on incoming base62-encoded parameters (path, header, query)
get_validated_uuidbase62
function that does not rely on a Model class/fieldUUIDBase62
instance properties
uuidbase62_value.uuid
: UUID matching the base62 encoded struuidbase62_value.base62_str
: non-prefixed base62 string valueuuidbase62_value.value
: prefixed base62 string value, same as str(uuidbase62_value)
uuidbase62_value.prefix
: the prefix used for this UUIDBase62
instanceimport uuid
from fastapi import FastAPI, Depends
from pydantic import BaseModel
from uuidbase62 import con_uuidbase62, UUIDBase62, UUIDBase62ModelMixin, get_validated_uuidbase62_by_model
app = FastAPI()
class Book(UUIDBase62ModelMixin, BaseModel):
id: con_uuidbase62(prefix="book")
title: str
@app.get("/", response_model=list[Book])
async def get_item_list():
# fake fetching a list of books from the DB, yielding book IDs and titles
return [{
"id": uuid.uuid4(),
"title": "Red Mars",
}]
@app.get("/{item_id}", response_model=Book)
async def get_item(item_id: UUIDBase62 = Depends(get_validated_uuidbase62_by_model(Book, 'id', 'item_id'))):
# fake fetching from the DB based on `item_id`, yielding a book ID and title
return {
"id": uuid.uuid4(),
"title": "Green Mars",
}
@app.post("/", response_model=Book)
async def create_item(item: Book):
book_id = item.id # UUIDBase62 value
book_id.uuid # uuid value
book_id.base62_str # non-prefixed base62 string value
book_id.value # prefixed base62 string value, same as str(book_id)
book_id.prefix # 'book'
return item.dict()
To set up a development environment, it is recommended to create a Python virtual environment, and then install
development requirements. You should probably be using
pyenv
to manage your local Python versions:
# do this for each supported Python version, all are needed to run complete tests via tox
pyenv install 3.x.x
# in the project directory, make supported Python versions available; first one listed is the default Python
pyenv local 3.10.x 3.7.x 3.8.x 3.9.x 3.11.x
# create Python virtual environment
python -m venv venv
# install development dependencies
./venv/bin/pip install -r requirements.txt
fastapi-uuidbase62
is easily tested via the configuration set up with tox
, which configures the tox
command line tool:
# run tox, parallel mode
./venv/bin/tox -p
Leverage Github issues, and do consider submitting fixes/improvements via pull requests on Github.
FAQs
Leverage Stripe-formatted IDs for internal UUID values in your Pydantic models and FastAPI views; automatically validates prefixes, and converts to/from UUID values.
We found that fastapi-uuidbase62 demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.